Cyber Security Engineer – Data Engineer

Sharp Decisions; Charlotte (NC); Hybrid; USD 90,000 - 150,000; Full time

Job summary

Sharp Decisions seeks a Cyber Security Engineer – Data Engineer, Associate to join the Cyber Security Operations team. You will design, build, and maintain scalable data ingestion pipelines for security telemetry across Azure Data Explorer, Log Analytics, and cloud/on‑prem environments.

You will partner with application, infrastructure, security, and governance teams to ensure telemetry is collected, normalized, validated, and available for threat detection, incident response, and risk

Qualifications

• Minimum of 3 years in cybersecurity, data engineering, log management, or related tech.
• Hands-on onboarding, managing, and validating log sources in SIEM or cloud data platforms.
• Strong parsing, normalization, transformation, and validation techniques (regex, JSON, XML, CSV).
• Familiarity with network, endpoint, identity, application, cloud, and infrastructure logs.
• Experience with cloud logging, monitoring, and analytics services.
• Ability to troubleshoot data pipelines, schema issues, and data quality defects.

Responsibilities

• Design, build, and maintain scalable data ingestion pipelines for onboarding security log sources into SIEM and cloud data platforms, including Azure Data Explorer and Log Analytics.
• Parse, normalize, transform, and enrich structured and unstructured log data using regex, JSON parsing, schema mapping, and data validation.
• Onboard new log sources and confirm end-to-end data flow with stakeholders across teams and vendors.
• Validate log integrity, completeness, timeliness, and quality for monitoring, detection, response, and reporting use cases.
• Align onboarded data to standards, schemas, naming conventions, and data governance expectations.
• Troubleshoot ingestion, parsing, transformation, and pipeline issues across diverse log sources and environments.
• Develop and maintain documentation for log onboarding, data mappings, source requirements, and configurations.
• Collaborate with detection engineering and SOC teams to support threat detection and cyber risk visibility.
• Conduct telemetry gap analysis; recommend onboarding priorities to improve security coverage.
• Support logging and data collection practices aligned with regulatory, audit, retention, and integrity requirements.
• Improve ingestion frameworks, automation, and onboarding workflows for efficiency and cost effectivity.
• Support infrastructure-as-code, scripting, and automation to streamline deployment and maintenance.
• Monitor pipeline performance and optimize ingestion reliability, throughput, and cost.
• Stay current on logging standards, telemetry formats, and cloud security data platform capabilities.

Skills

Data ingestion

Data parsing

Data normalization

Data validation

Threat detection

Incident response

Cloud security

Regulatory compliance

Scripting

Cross-functional collaboration

Tools

Azure Data Explorer

Log Analytics

Python

PowerShell

Job description

Client is seeking a Cyber Security Engineer – Data Engineer, Associate to join the Cyber Security Operations team. This role will help strengthen the monitoring, detection, and response capabilities by building, onboarding, and maintaining high-quality security data pipelines across cloud and on-premises environments.

The successful candidate will partner with application, infrastructure, security, and governance teams to ensure critical telemetry is collected, normalized, validated, and made available for threat detection, incident response, compliance, and cyber risk visibility.

This is a hands-on engineering role for a candidate who is comfortable working with large volumes of security telemetry, solving complex data quality issues, and improving the reliability, scalability, and efficiency of log ingestion and data integration processes. The role requires strong technical execution, attention to detail, and the ability to collaborate across global teams in a highly regulated financial services environment.

Role Responsibilities

• Design, build, and maintain scalable data ingestion pipelines for onboarding security log sources into SIEM and cloud data platforms, including Azure Data Explorer and Log Analytics.
• Parse, normalize, transform, and enrich structured and unstructured log data using techniques such as regex, JSON parsing, schema mapping, and data validation.
• Partner with application owners, infrastructure teams, cloud teams, vendors, and security stakeholders to onboard new log sources and confirm end-to-end data flow.
• Validate log integrity, completeness, timeliness, and quality to ensure security telemetry is reliable and fit for monitoring, detection, response, and reporting use cases.
• Align onboarded data to organizational standards, schemas, naming conventions, and data governance expectations to support downstream analytics and automation.
• Troubleshoot ingestion, parsing, transformation, and pipeline issues across diverse log sources, platforms, and environments.
• Develop and maintain documentation for log onboarding procedures, data mappings, source requirements, pipeline configurations, and operational support processes.
• Collaborate with detection engineering and SOC teams to ensure onboarded logs support threat detection, investigation, response, and cyber risk visibility requirements.
• Conduct telemetry gap analysis to identify missing, incomplete, or underrepresented data sources and recommend onboarding priorities to improve security coverage.
• Support logging and data collection practices that align with regulatory, audit, compliance, retention, and integrity requirements.
• Improve ingestion frameworks, automation, and onboarding workflows to increase efficiency, repeatability, scalability, and cost effectiveness.
• Support infrastructure-as-code, scripting, and automation approaches where appropriate to streamline deployment and ongoing maintenance.
• Monitor pipeline performance and partner with stakeholders to optimize ingestion reliability, throughput, and cost efficiency.
• Stay current on emerging logging standards, telemetry formats, cybersecurity data engineering practices, and cloud security data platform capabilities.

Qualifications and Skills

• Minimum of 3 years of relevant experience in cybersecurity, data engineering, log management, security operations, or a related technology discipline.
• Hands-on experience onboarding, managing, and validating log sources in SIEM, cloud data platforms, or security analytics environments.
• Strong understanding of data parsing, normalization, transformation, and validation techniques, including regex, JSON, XML, CSV, and structured and unstructured data handling.
• Familiarity with common security telemetry sources, including network, endpoint, identity, application, cloud, and infrastructure logs.
• Experience with cloud platforms and associated logging, monitoring, and analytics services.
• Strong troubleshooting and problem-solving skills related to data pipelines, ingestion flows, schema issues, and data quality defects.
• Understanding of compliance and regulatory expectations related to logging, retention, auditability, and data integrity.
• Experience with scripting or automation tools such as Python, PowerShell, or similar technologies is preferred.
• Familiarity with query languages used to validate, investigate, and analyze ingested data.
• Ability to plan, coordinate, and execute onboarding efforts across multiple internal teams, vendors, and stakeholders.
• Ability to balance operational support responsibilities with project-based delivery and continuous improvement efforts.
• Strong attention to detail, commitment to data quality, and ownership of outcomes.
• Experience in broader cybersecurity disciplines, including threat detection, incident response, vulnerability management, or cloud security, is a plus.
• Ability to work effectively and collaboratively in a global team environment.
• Strong communication skills, sound judgment, and a high degree of accountability.